To configure proxy requests for a firewall
policy rule
In the console tree of ISA Server Management, click
Firewall Policy.
In the details pane, click the applicable publishing rule.
On the Tasks tab, click Edit Selected Rule.
On the To tab, select one of the following:
Requests appear to come from the ISA Server computer.
When this is selected, the IP address making the request will
appear to be the ISA Server computer. You hide the address of the
client making the request.
Requests appear to come from the original client. When
this is selected, the IP address making the request will appear to
be the client. Some applications require actual identification by
the real requesting client. When you publish these applications,
you can configure ISA Server to forward requests with the IP
address of the requesting (source) client.
Notes
To open ISA Server Management, click Start, point to
All Programs, point to Microsoft ISA Server, and then
click ISA Server Management.
For ISA Server 2006 Enterprise Edition, expand
Microsoft Internet Security and Acceleration
Server 2006, expand Arrays, expand
Array_Name, and then click Firewall
Policy.
For ISA Server 2006 Standard Edition, expand Microsoft
Internet Security and Acceleration Server 2006, expand
Server_Name, and then click Firewall
Policy.
Important
Some applications require identification by the requesting
client. When you publish these applications, select the Requests
appear to come from the original client option.
When you select the Requests appear to come from the
original client option, ISA Server must be configured as the
gateway for the published Web server. Alternatively, ISA Server can
be configured as the default gateway for the IP address of the
original client.
If you turn on the Requests appear to come from the ISA
Server computer setting, the ISA Server computer also replaces
the source address of the incoming request so the packets that are
sent to the internal server have the source address of the ISA
Server computer. This permits the IP routing configuration in these
large networks to route the packets back to the ISA Server
computer. The ISA Server can then use network address translation
(NAT) to send the packets back to the original external host where
the request originated.
The Requests appear to come from the ISA Server computer
feature works only if the published protocol does not require an
application filter. In other words, the feature works correctly if
there are no secondary connections that are defined for the
protocol. An exception to this rule occurs when you publish FTP and
RPC servers that have application filters. FTP and RPC application
filters support the Requests appear to come from the ISA Server
computer feature.
Translation of the client source address permits server
publishing to work correctly when you use Network Load Balancing on
the external interface of the ISA Server computer. Without this
change, server publishing is not supported when you use Network
Load Balancing on the external interface.
After you click Apply in the details pane, the policy is
updated. The new policy applies only to new connections.